Description
A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges.
Published: 2026-10-08
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

A missing authorization check in the Brocade Fabric OS REST API allows any authenticated user to retrieve complete Monitoring and Alerting Policy Suite data across all logical switches. This flaw enables a low‑privilege attacker to dump chassis‑wide system health metrics, port performance violations, and configuration details that should be protected. The vulnerability is a classic missing authorization (CWE‑862).

Affected Systems

Brocade Fabric OS versions earlier than 10.0.1 are affected. The security update addresses the flaw in Fabric OS 10.0.1.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. EPSS information is not available and the issue is not listed in CISA KEV. An authenticated attacker with any role can exploit the exposed endpoint over the network API; no additional access is required. The attack vector is inferred to be remote API access, but the description does not detail further exploitation steps.

Generated by OpenCVE AI on October 8, 2026 at 04:29 UTC.

Remediation

Vendor Solution

Security update is provided in Brocade Fabric OS 10.0.1

OpenCVE Recommended Actions

  • Apply the security update to Brocade Fabric OS 10.0.1 soon after release.
  • Restrict API access to only trusted management hosts and use network segmentation to isolate the Fabric OS controller.
  • Confirm that user roles are correctly defined and that no privileged API endpoints are exposed to lower‑privilege accounts.

Generated by OpenCVE AI on October 8, 2026 at 04:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom fabric Operating System
CPEs cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom fabric Operating System
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Thu, 08 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Brocade
Brocade fabric Os
Vendors & Products Brocade
Brocade fabric Os

Thu, 08 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Title Missing Authorization Enables Full MAPS Violation Data Dump

Thu, 08 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Description A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges.
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Fabric Operating System
Brocade Fabric Os
cve-icon MITRE

Status: PUBLISHED

Assigner: brocade

Published:

Updated: 2026-10-08T13:17:32.703Z

Reserved: 2026-09-08T22:51:12.166Z

Link: CVE-2026-87669

cve-icon Vulnrichment

Updated: 2026-10-08T13:17:04.919Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T03:16:36.237

Modified: 2026-10-13T17:17:43.257

Link: CVE-2026-87669

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T04:45:16Z

Weaknesses